next

• Outcome: Review
• Latest audit: Sep 1, 2026 · 10:52 PM UTC
• Version: 0.9.2

Overview

This next-action helper is broadly disclosed but needs Review because it auto-triggers and can inspect local session state, workspace backlogs, GitHub/organization data, and write debug logs beyond a simple suggestion feature.

Install only if you want an assertive workflow-orchestration helper that can auto-trigger after task completion, inspect task lists and workspace planning files, query GitHub/CI and possibly org Copilot billing data, and keep local hook debug logs. Review the hook registration, disable or restrict debug logging if sensitive transcripts are possible, and avoid installing it in environments where 'local-only' must mean no remote GitHub or organization API access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill's documented purpose is limited to suggesting next actions, but its behavior and instructions expand into broader autonomous triggering and incomplete/unenforced control logic. That mismatch is dangerous because operators may trust the declared scope while the skill activates in additional contexts or omits promised safety gates, leading to unintended execution paths and unreliable policy enforcement.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This section instructs the agent to inspect environment variables, transcript logs, file sizes, and local hook manifests, which exceeds the minimum data needed to suggest a next step. Even if intended for context-aware UX, it expands local reconnaissance surface and can expose sensitive operational metadata from the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill directs discovery through GitHub CLI, CI runs, and possibly Plane project tracking, which broadens it from a simple next-action suggester into a cross-system enumerator. That creates unnecessary access to external state and may reveal private repo, issue, PR, or workflow information in contexts where the user only asked for lightweight follow-up suggestions.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill metadata says the skill is local-only, but this section requires network-backed GitHub queries, including reviewer state and org-level API checks, to compose options. That mismatch can cause the agent to perform remote discovery and access checks under a trust model where operators expect only local behavior, expanding data exposure and permission use beyond the declared scope.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The file instructs querying `orgs/<org>/copilot/billing`, which is organization-level administrative data unrelated to a generic next-action suggestion function. Accessing billing/seat-management state broadens the required privilege surface and may expose sensitive org configuration information to a skill that should only help compose follow-up choices.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documented use of remote GitHub and organization API operations conflicts with the manifest's local-only description, undermining operator expectations and security review assumptions. Such scope drift is dangerous because defenders may allow the skill in restricted environments believing it cannot reach external systems when its guidance in fact depends on them.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases include broad terms like 'stuck' or 'what next', which can appear in many unrelated conversations and cause the skill to activate unexpectedly. In an auto-invoked skill, overbroad matching increases the risk of unrequested task discovery, prompting, or auxiliary tool usage.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: An automatic trigger based on generic 'completion keywords' is ambiguous and can fire on routine assistant phrasing rather than true task completion. That makes the skill prone to accidental activation and compounds the danger because it may then inspect task state or external systems without a clearly intended user request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The hook writes a snippet of the last assistant text, transcript path, and metadata to a local debug log without user disclosure or consent. Because assistant text can contain sensitive user-derived content, this creates an unnecessary persistence channel and increases exposure through local file access, backups, or later forensic collection.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation scope is defined as a post-completion check after /next suggests actions or after any skill completes, which is broad enough to trigger on routine completions with little context gating. In an agentic system, this can cause unsolicited /fix invocations, creating action cascades or unintended follow-up execution without a strong signal that remediation is actually needed.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The detection logic uses open-ended checks like pending tasks, workflow rules, unchecked boxes, incomplete sub-steps, and implied actions from user responses, but it does not define thresholds, precedence, or stopping conditions. That ambiguity makes the skill easy to over-trigger, especially in environments with task lists and checklists, leading to incorrect autonomous remediation attempts and possible execution of actions the user did not intend at that moment.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.